user.createNewSecurityToken();

public void createNewSecurityToken() {
  var buffer = new byte[32];
  new RNGCryptoServiceProvider().GetBytes(buffer);  // <--- here's the issue
  this.Token = Convert.ToBase64String(buffer);
}

user.setSecurityToken(token);    // pass it in